B RITISH B ANKERS' A SSOCIATION Operational Risk & the Regulatory Environment Simon Hills Director - Prudential Capital team

Operational Risk & the Regulatory Environment What is Prudential Capital regulation for? n enhancing stability of the financial system n protecting depositors n advancing financial institutions‘ risk management n ensuring level-playing field by further aligning regulatory practices But: n capital is expensive n trade-off between stability and efficiency of banking system

Operational Risk & the Regulatory Environment Basel I n Relatively crude risk weighting system n Inadequate incentives for risk mitigation (and some perverse incentives) n Some categories of risk not covered at all n Market developments not properly reflected – new products new products avoidance/mitigation techniques avoidance/mitigation techniques

Operational Risk & the Regulatory Environment Basel 2 n More flexible, risk sensitive system n Overall capital broadly unchanged under standard approach, but with incentives for better risk management n Competitive equality n Emphasis on banks’ own internal control, management and risk assessment, with supervisory evaluation n Market discipline

Operational Risk & the Regulatory Environment Structure of new Accord: the three pillars n Pillar I – minimum capital requirement n Pillar II – supervisory review n Pillar III – market discipline

Operational Risk & the Regulatory Environment n Replaces Basel 1 which requires banks to hold 8% of funds lent in capital n Capital required to cover credit, market and operational risk n Operational risk charge covers expected and unexpected losses – but not catastrophic loss n Must quantity operational risk – and assess the quality of Operational Risk management in order to ensure that banks that manage risk well see a reduction in regulatory capital

Operational Risk & the Regulatory Environment Operational risk Risk of loss from inadequacy/failure of internal processes/systems people or external events: includes legal risk but not strategic and reputation risk n “Basic indicator” and “standardised” approaches based on income (differentiated by business line in standardised approach) n “Advanced measurement approach” uses risk measure generated by bank’s internal operational risk measurement system n AMA permitted only where specified standards satisfied

Operational Risk & the Regulatory Environment Problems with Quantification n Inadequate or insufficient data to build a well populated database n Need to apply imprecise measures for frequency and impact n No quantifiable size of exposure amount due to impossibility of forecasting how different risk issues will combine to produce a major operational loss event

Operational Risk & the Regulatory Environment Problems with Quantification n Can’t know when portfolio of risks is complete n Context dependent – reduction in relevance of historic loss data n Not an exact science! n Main benefit – to prioritise management actions and assess Cost benefit of mitigation measures

Operational Risk & the Regulatory Environment The Basic Indicator Approach n Hold capital for operational risk equal to 15% of average annual gross income over the previous three years n Gross income is net interest income + net non-interest income + gross of provisions and before profits/losses from sale of securities in the banking book, extraordinary items and insurance income. n No specific qualitative requirements but banks using the approach are encouraged to comply with the requirements of the Sound Practices paper

Operational Risk & the Regulatory Environment The Standardised Approach n Under the Standardised approach the institution divides its activities into 8 business lines. n Each business line has a beta factor based on the perceived “riskiness” of each activity. n The capital charge for each business line will be found by multiplying the gross income by the beta factor. n The resulting figures will be added together to find the overall capital charge. n A qualitative assessment of the OR management framework will be carried out by Regulators before this approach can be used and certain governance standards must be met.

Operational Risk & the Regulatory Environment Business Lines and Beta Factors n Corporate Finance 18% n Trading and Sales18% n Retail Banking 12% n Commercial Banking15% n Payment and Settlement18% n Agency Services15% n Asset Management12% n Retail Brokerage12%

Operational Risk & the Regulatory Environment The Advanced Measurement Approaches n Under the AMA, the regulatory capital requirement will equal the risk measure generated by the bank’s internal operational risk management system using the quantitative and qualitative criteria for the AMA. n The methodology developed by the bank will need to be approached by the regulator before use. n Under the AMA the capital charge may be reduced by up to 20% to reorganise the mitigating effect of insurance.

Operational Risk & the Regulatory Environment Firms must track internal loss data and meet the following standards:  5 year observation period (3 years initially).  Reviewed regularly to ensure consistency with current activities.  Mapped to the Basel loss categorisation.  Comprehensive above a threshold.  Appropriately and consistently assigned.  Consistent, defined boundaries with other risk types

Operational Risk & the Regulatory Environment n What are the characteristics of the loss events? n What are the key factors in determining size and frequency of loss? n Why was the tail event more significant? n Can we think of other scenarios that could give rise to similarly significant losses? n Is there anything we can do to stop these events? n Is it our belief that the dataset represents a “typical” year? n Are we capturing the full range of potential loss events in the histogram? Does this reflect our full risk profile? n Do the losses that have occurred fully illustrate our risk exposures?

Operational Risk & the Regulatory Environment Conclusions n Management not Measurement n Imprecise science n Integrate measurement into Operational Risk Management framework n Use data to inform decisions Control framework Evaluate mitigation Prioritise corrective action n Low frequency/High impact events drive operational risk capital!